Online HMAC Signature & Hash Generator

Compute and verify keyed-hash message authentication codes (HMAC-SHA256, HMAC-SHA512) for webhooks and APIs. 100% private in-browser tool.

At a glance

HMAC Signature & Authentication Hash Generator is a free online tool that computes and verifies cryptographic HMAC signatures (SHA-256, SHA-512, SHA-384, SHA-1) in Hex, Base64, and Base64URL formats. It supports UTF-8 plaintext, Hex-encoded, and Base64-encoded secret keys. Nothing is uploaded and no sign-up is needed — everything runs on your device.

Security Suite: HMAC Generator Token Generator Hash Generator JWT Decoder Password Generator Base64

100% Client-Side Web Crypto SubtleCrypto

Cryptographic HMAC calculations execute entirely in local browser memory. Zero secret keys, webhooks, or payloads ever touch any server.

Pure In-Browser

Webhook & API Presets:

Algorithm:

256-bit Digest

Secret Key

Key Encoding:

Message Payload

89 chars • 1 line

Generated HMAC Signatures 32 bytes (256 bits)

Hexadecimal Digest (Lower / Upper):

64 chars

Base64 Signature:

Base64URL (JWT unpadded):

Signature Verifier & Header Comparator

Strips sha256=, v1= automatically

What is an HMAC?

A Hash-based Message Authentication Code (HMAC) pairs a cryptographic hash function with a secret shared key. It verifies both data integrity (message hasn't changed) and authenticity (sender possesses the secret key).

Webhook Security Workflow

Services like GitHub (X-Hub-Signature-256) and Stripe sign incoming webhook payloads. Your backend computes the HMAC of the raw request body with your secret key to confirm the event genuinely came from the provider.

Timing Attack Protection

When validating HMAC signatures in production applications, always use a constant-time equality check (such as crypto.timingSafeEqual) to prevent attackers from inferring valid signature bytes through execution latency.

Why Use This HMAC Signature & Authentication Hash Generator?

High-Performance Web Crypto API: Hardware-accelerated SubtleCrypto computation for HMAC-SHA-256, SHA-512, SHA-384, and SHA-1.

Multi-Format Secret Key Ingestion: Supports UTF-8 plaintext, Hex-encoded, and Base64-encoded secret keys.

Instant Signature Verifier: Real-time cryptographic comparison against incoming webhook or API signatures with prefix handling (sha256=, v1=).

Multiple Output Encodings: Instant export in Lowercase Hex, Uppercase Hex, standard Base64, and URL-safe unpadded Base64URL.

File & Payload Processing: Sign raw text, JSON payloads, or drag-and-drop binary files up to 500MB without server upload.

100% Client-Side Privacy: Secrets and payloads never leave your browser memory. Zero network logging or telemetry.

How to Use HMAC Signature & Authentication Hash Generator

Select Algorithm & Enter Secret Key

Choose HMAC-SHA256, SHA512, SHA384, or SHA1. Enter your secret key in UTF-8, Hex, or Base64 format, or click 'Generate Secret' for a CSPRNG key.

Provide Message or File

Type or paste your payload, request body, or webhook JSON into the message box, or drop a binary file into the dropzone.

Copy HMAC or Verify Signature

Instantly copy the computed signature in Hex, Base64, or Base64URL format, or switch to the Verifier tab to test an incoming signature.

Worked example: GitHub HMAC-SHA-256 Signature

The engine imports the key via crypto.subtle.importKey and signs with crypto.subtle.sign HMAC, then exports hex, Base64, and Base64URL in parallel.

Payload and Example Secret Key Source

Algo: HMAC-SHA-256 | Key: whsec_example_secret | Message: POST /webhooks {"ref":"refs/heads/main"}

Multi-Format HMAC Digest Processed

Hex: 681897728938edd6157be5cd388413080c414ea85a325e9e9e03718120360c2e (truncated example)

Technical Specifications & Engine Details

Technical specifications and engine details for HMAC Signature & Authentication Hash Generator
Specification	Details
Supported Formats	TEXT, FILE → HEX, BASE64, BASE64URL
Execution Mode	100% Client-Side In-Browser (client)
Browser Requirements	Requires modern web browser with Web Cryptography API (SubtleCrypto).
Performance Constraints	Client browser memory limit (typically 1–2 GB RAM); processing speed depends on local device CPU.

Maintained by Pragyan Pahadi

100% Client-Side Privacy Guarantee

All cryptographic HMAC calculations and key operations run 100% locally in your browser memory using the Web Cryptography API. Zero secret keys or data packets are sent over the network.

Frequently Asked Questions

What is an HMAC and how does it work?

A Keyed-Hash Message Authentication Code (HMAC) is a specific construction for calculating a cryptographic message authentication code involving a cryptographic hash function (such as SHA-256) and a secret cryptographic key. It verifies both the data integrity and authenticity of a message.

Are my secret keys and payloads safe in this tool?

Yes, absolutely. All calculations are executed locally inside your web browser using the standard Web Cryptography API (window.crypto.subtle). No keys, messages, or files are ever sent across the network or stored on any server.

Can I verify GitHub and Stripe webhook signatures?

Yes. Use our presets or paste your webhook payload and secret. The signature verifier automatically recognizes and strips prefixes like 'sha256=' (GitHub) and 'v1=' (Stripe) to confirm signature authenticity.

What is the difference between Base64 and Base64URL?

Standard Base64 uses '+' and '/' characters with '=' padding. Base64URL replaces '+' with '-' and '/' with '_', and omits padding, making it safe for inclusion in URLs, query strings, and JSON Web Tokens (JWT).

Methodology

This tool runs entirely in your browser. The example above shows a representative input and the result it produces.

Last updated October 2026.